Attack Surface Detector
Summary: The Attack Surface Detector is a Burp Suite plugin, authored by Drew Kirkpatrick and Matthew DeLetto and last updated 16 December 2021, that identifies a web application's endpoints, the parameters those endpoints accept, and the data types of those parameters. It is built to surface unlinked endpoints and optional parameters that DAST tools such as Burp Suite and ZAP miss when spidering, then imports that data into Burp Suite for review or use from the target site map.
Key Takeaway: Endpoints and parameters a spider never finds go untested, which the source says can leave an application open to an attacker - so the gaps in your scan coverage are the part of the attack surface you cannot see in the site map.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026